📘 Free SC-300 Sample Questions
You have an Azure Active Directory (Azure AD) tenant that contains the following objects:
✑ A device named Device1
✑ Users named User1, User2, User3, User4, and User5
✑ Groups named Group1, Group2, Group3, Group4, and Group5
The groups are configured as shown in the following table.
To which groups can you assign a Microsoft Office 365 Enterprise E5 license directly?
A
Group1 and Group4 only
B
Group1, Group2, Group3, Group4, and Group5
C
Group1 and Group2 only
D
Group1 only
E
Group1, Group2, Group4, and Group5 only
Correct Answer:
B. Group1, Group2, Group3, Group4, and Group5
Explanation:
You can assign licences to any group created within the Azure AD portal.
These can include security groups, Microsoft 365 groups, and either assigned or dynamic groups.
You can even create a dynamic device security group and assign E5 licences to it, which doesn't make sense but is true (I've tested it).
However, the missing bit of information is whether the Microsoft 365 groups have the "SecurityEnabled" attribute set to True.
Only M365 groups that have the "SecurityEnabled" attribute set to True can have licences assigned to them.
If the group is created in the M365 Admin Centre, then the "SecurityEnabled" attribute is set to False and you can not assign licences to the group.
But if the M365 group is created in the Azure AD portal, then the "SecurityEnabled" attribute is set to True and you can assign licences.
For the answer, I would make an assumption that because this is an Identity-related exam testing us on Azure AD topics, that the M365 groups were created in the Azure AD portal and therefore have the "SecurityEnabled" attribute set to True.
Which means the correct answer is B - all groups.
You have a Microsoft Exchange organization that uses an SMTP address space of contoso.com.
A
Set-MsolCompanySettings
B
Set-MsolDomainFederationSettings
C
Update-MsolfederatedDomain
D
Set-MsolDomain
Correct Answer:
A. Set-MsolCompanySettings
Explanation:
As reference, Self-service sign-up: Method by which a user signs up for a cloud service and has an identity automatically created for them in Azure AD based on their email domain.
Azure AD cmdlet Set-MsolCompanySettings could help you to prevent creating user accounts with parameters:
AllowEmailVerifiedUsers (users can join the tenant by email validation)-->when is TRUE.
AllowAdHocSubscriptions (controls the ability for users to perform self-service sign-up)
e.g. Set-MsolCompanySettings -AllowEmailVerifiedUsers $false -AllowAdHocSubscriptions $false
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/directory-self-service-signup
You have a Microsoft 365 tenant that uses the domain named fabrikam.com. The Guest invite settings for Azure Active Directory (Azure AD) are configured as shown in the exhibit. (Click the Exhibit tab.)
A
User2 only
B
User1 only
C
User1 and User2 only
D
User1, User2, and User3
Correct Answer:
A. User2 only
Explanation:
Correct Answer= A
Here [Email Protected]= bsmith@fabrikam.com
https://docs.microsoft.com/en-us/azure/active-directory/external-identities/one-time-passcode#when-does-a-guest-user-get-a-one-time-passcode
"When the email one-time passcode feature is enabled, newly invited users who meet certain conditions will use one-time passcode authentication. Guest users who redeemed an invitation before email one-time passcode was enabled will continue to use their same authentication method."
User 1 is already a registered guest user in fabrikan.com so will not receive additional OTP.
User 2 has never accessed fabrikam.com so WILL receive OTP each time they login.
User 3 (providing email addy is not a typo) will not receive a OTP as they are a domain user.
Answer is A.
You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses.
The licenses are assigned to individual users.
From the Groups blade in the Azure Active Directory admin center, you assign Microsoft 365 Enterprise E5 licenses to the users.
You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.
What should you use?
A
the Identity Governance blade in the Azure Active Directory admin center
B
the Set-AzureAdUser cmdlet
C
the Licenses blade in the Azure Active Directory admin center
D
the Set-WindowsProductKey cmdlet
Correct Answer:
C. the Licenses blade in the Azure Active Directory admin center
Explanation:
You can unassign licenses from users on either the Active users page, or on the Licenses page.
The method you use depends on whether you want to unassign product licenses from specific users or unassign users licenses from a specific product.
Note:
There are several versions of this question in the exam. The question has two possible correct answers:
1. the Licenses blade in the Azure Active Directory admin center
2. the Set-MsolUserLicense cmdlet
Other incorrect answer options you may see on the exam include the following:
? the Administrative units blade in the Azure Active Directory admin center
? the Groups blade in the Azure Active Directory admin center
? the Set-AzureAdGroup cmdlet
Reference:
https://docs.microsoft.com/en-us/microsoft-365/admin/manage/remove-licenses-from-users?view=o365-worldwide
HOTSPOT -
You have a Microsoft 365 tenant named contoso.com. Guest user access is enabled.
Users are invited to collaborate with contoso.com as shown in the following table.
From the External collaboration settings in the Azure Active Directory admin center, you configure the Collaboration restrictions settings as shown in the following exhibit.
A
Correct Answer:
A.
Explanation:
Here [Email Protected] = user3@adatum.com Box 1: yes.
Box2: yes Box 3: No
You have an Azure Active Directory (Azure AD) tenant named contoso.com.
You plan to bulk invite Azure AD business-to-business (B2B) collaboration users.
Which two parameters must you include when you create the bulk invite? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A
email address
B
redirection URL
C
username
D
shared key
E
password
Correct Answer:
A. email address
You have an Azure Active Directory (Azure AD) tenant that contains the objects shown in the following table.
Which objects can you add as members to Group3?
A
User2 and Group2 only
B
User2, Group1, and Group2 only
C
User1, User2, Group1 and Group2
D
User1 and User2 only
E
User2 only
Correct Answer:
E. User2 only
Explanation:
Tested in Lab environment:
Mail enabled Security Group can only be managed in the M365 Admin Center.
In AAD, you can't modify the membership. - "Some groups can't be managed in the Azure Portal."
In the M365 admin center, only users can be added to the mail-enabled security group.
You can only add licensed users to the group, unlicensed users won't even show up on the member select page.
Correct answer is definitely E.
DRAG DROP -
A
Correct Answer:
A.
Explanation:
https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/domains-admin-takeover
HOTSPOT -
A
Correct Answer:
A.
Explanation:
Group A - User1, Group1, Group2 and Group3.Group A cannot contain M365 groups. Group B - User1 only; M365 groups cannot contain other groups.
Reference:
https://bitsizedbytes.wordpress.com/2018/12/10/distribution-security-and-office-365-groups-nesting/
Note: This question is part of a series of questions that present the same scenario.
Each question in the series contains a unique solution that might meet the stated goals.
Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it.
As a result, these questions will not appear in the review screen.
You have an Active Directory forest that syncs to an Azure Active Directory (Azure AD) tenant.
You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes.
You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.
Solution: You configure password writeback. Does this meet the goal?
A
yes
B
no
Correct Answer:
B. no
Explanation:
Password writeback is a feature of Azure AD Connect which ensures that when a password changes in Azure AD (password change, self-service password reset, or an administrative change to a user password) it is written back to the local AD – if they meet the on-premises AD password policy.
Technically, a password write-back operation is a password “reset” action.
Password writeback removes the need to set up an on-premises solution for users to reset their password.
It all happens in real time, and so users are notified immediately if their password could not be reset or changed for any reason.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/choose-ad-authn
Questions: 1-10 out of 442
Continue Full Practice..
GET ALL 442 QUESTIONS